fabb3abd0bda132733d6b327b749f9f4742ecb97787a05576a69b822bcb5aae4

Analysis

max time kernel
298s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libpsl-5.dll
Size 2.5MB
Sample260709-d869fsc18v
SHA256 fabb3abd0bda132733d6b327b749f9f4742ecb97787a05576a69b822bcb5aae4
MD5 830da08203d63ced37e2091258d6cb88
SHA1 c518ec339cc97a8c4422a2f25e5b169a36ce98da
SHA512 3155c6b446d8db8940f5da1444e79742f4fff30fb431776dacce5a4b74f62b0d07984341236402d29dd41380c01a65b47521a67e8f06e91f7ea03206e741d6af
SSDEEP 49152:qk42vuOIqfbzL4TBR42dGjo3x0ImQdIOrT9YtPaKWIVeaKKVQshh2kaljJGmHBLT:qKf36J3x00IOrT9YtPaKWIVeaKKVQshW
TLSH
T17AC5AF56B3C05AA6C126E93487679232C3B2B8124B76D2CF795AD70A1F77F804F39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinPslUpd = "cmd /c start \"\" /D \"C:\\ProgramData\\WinPslUpd\" rundll32.exe"	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 3768	3976	cmd.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libpsl-5.dll,#1
1⤵
- Adds Run key to start application
PID:3180

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\WinPslUpd" rundll32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\system32\rundll32.exe
  rundll32.exe"
  2⤵
  PID:3768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dpnhupnp.dll

Path C:\ProgramData\WinPslUpd\dpnhupnp.dll
Size 10KB
SHA256 7cf4535e85ec02365c54bf460992344fe1e319381e794e51a7ce0f9cb0438929
MD5 ba32bb24b7da23bd7ee7ae4b576338cd
SHA1 17731367250361c6b1aaf24f988b8dd1150b1e92
SHA512 4317c083c491e74ef7e1ad30d79164b3d6ba360f3b83a88d220b21385837049a33c3023c5f9d10c42980c45fecc747d271263242976435abab7612c26e486be4
SSDEEP 96:FjxR3HUNj9fs2Qz6IDyBTFdesMH3aLbJ0lq5/sEWRuWwl:FtmzzyyBJdQH3aXSlSWRuW
TLSH
T1CE22A80AB7B809ADF06602F8876A5D5AE1757110536266EF0230C35D3F2EBD1BD34BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads